CVE-2024-36494 — Reflected Cross Site Scripting
Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The login page at /cgi/slogin…
Published: 2024-12-12 · CVSS: 4.7 · CVSS 3.1
Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The login page at /cgi/slogin.cgi suffers from XSS due to improper input filtering of the -tsetup+-uuser parameter, which can only be exploited if the target user is not already logged in. This makes it ideal for login form phishing attempts.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7